[chaliy]

Motivation

• Subshells, command substitutions, arithmetic substitutions, and path-based script execution were documented to run in isolated child contexts but the per-instance $RANDOM LCG state (random_state) was not saved/restored, allowing child code to advance or reseed the parent PRNG.
• RANDOM=N reseeding executed before readonly enforcement, so readonly RANDOM did not protect the PRNG state.

Description

• Add random_state: u32 to SubshellSnapshot and include it in snapshot_subshell_state() and restore_subshell_state() so command/arith substitutions and subshells no longer leak PRNG mutations.
• Save and restore random_state around path-based script (bash -c / file-exec) execution so path-subprocess isolation preserves parent PRNG state.
• Move RANDOM=N reseed handling to after readonly attribute checks in set_variable() so readonly RANDOM blocks reseeding, and add focused regression tests covering subshells, command substitution, arithmetic substitution, bash -c, path script isolation, and readonly protection for RANDOM.

Testing

• Ran cargo fmt --check which succeeded.
• Ran targeted unit tests interpreter::tests::test_random_state_isolated_from_subshell_contexts, interpreter::tests::test_random_state_isolated_from_path_script, and interpreter::tests::test_readonly_random_blocks_reseed and all passed.
• Ran cargo test -p bashkit random_state --lib and cargo test -p bashkit test_readonly_random_blocks_reseed --lib (and the combined test/check sequence used in verification) and they all passed; git diff --check also reported no issues.

---

Codex Task

[Copilot]

Pull request overview

This PR fixes a state-leak in the interpreter’s $RANDOM implementation by ensuring the per-instance PRNG state (random_state) is properly isolated across child execution contexts (subshells/substitutions and path-based script execution), and by enforcing readonly RANDOM before allowing reseeds.

Changes:

• Add random_state to subshell snapshots and restore it after command/arithmetic substitutions and subshell execution.
• Save/restore random_state around path-based script execution so child scripts can’t mutate the parent’s PRNG stream.
• Move RANDOM=N reseed handling to after readonly checks and add regression tests for isolation + readonly protection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	c3c1526	Commit Preview URL	Jun 05 2026, 08:10 PM